https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=167822
Freddy DISSAUX <d...@bsdsx.fr> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |d...@bsdsx.fr
--- Comment #3 from Freddy DISSAUX <d...@bsdsx.fr> ---
If ipfw is configured like this:
/etc/rc.conf.d/ipfw/_networks
1 firewall_ipv4="172.16.200.0/24 172.17.200.0/24 172.16.10.0/24
172.17.10.0/24"
2 firewall_ipv6="2a01:db8:cafe:f660::/64 2a01:db8:cafe:f666::/64"
/etc/rc.conf.d/ipfw/ipfw
1 firewall_enable="YES"
2 firewall_type="workstation"
3 firewall_myservices="ssh/tcp"
4 firewall_allowservices="$firewall_ipv4 $firewall_ipv6"
5 firewall_coscripts="/etc/rc.conf.d/ipfw_local"
/etc/rc.conf.d/ipfw/log
1 firewall_quiet="NO"
2 firewall_logging="YES"
3 firewall_logif="YES"
4 firewall_logdeny="YES"
the firewall_type variable will still be set to UNKNOWN
If i understand:
/etc/rc.d/ipfw start
- source /etc/rc.subr
- call load_rc_config ipfw (firewall_* are available)
- $firewall_script is set to /etc/rc.firewall (default)
- call /bin/sh /etc/rc.firewall
/etc/rc.firewall
- test if source_rc_confs_defined (always false)
- source /etc/rc.defaults/rc.conf => firewall_type set to 'UNKNOWN'
- source rc.subr (but not call load_rc_config !!!)
- test firewall_type (UNKNOWN)
=> fail
With attached patch, ipfw is configured as expected:
$ sudo ipfw list | grep 22$
02500 allow tcp from 172.16.200.0/24 to me dst-port 22
02600 allow tcp from 172.17.200.0/24 to me dst-port 22
02700 allow tcp from 172.16.10.0/24 to me dst-port 22
02800 allow tcp from 172.17.10.0/24 to me dst-port 22
02900 allow tcp from 2a01:db8:cafe:f660::/64 to me dst-port 22
03000 allow tcp from 2a01:db8:cafe:f666::/64 to me dst-port 22
With pirzyk'patch i can force firewall_type (using my configuration):
$ sudo ipfw list | wc -l
40
$ sudo service ipfw stop
$ sudo service ipfw start open
$ sudo ipfw list | wc -l
12
$ sudo service ipfw stop
$ sudo service ipfw start
$ sudo ipfw list | wc -l
40
dsx@vaio>uname -a
FreeBSD vaio.bsdsx.fr 11.1-RELEASE FreeBSD 11.1-RELEASE #0 r321309: Fri Jul 21
02:08:28 UTC 2017 r...@releng2.nyi.freebsd.org:/usr/obj/usr/src/sys/GENERIC
amd64
dsx@vaio>freebsd-version
11.1-RELEASE-p6
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-ipfw@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "freebsd-ipfw-unsubscr...@freebsd.org"
